fix(doctrine): exclude self-reference relation links from GraphQL root item lookup (#8314)

Author: soyuka

src/Doctrine/Common/State/LinksHandlerTrait.php

@@ -36,10 +36,12 @@ private function getLinks(string $resourceClass, Operation $operation, array $co
 
         if (!($linkClass = $context['linkClass'] ?? false)) {
             // Root item lookup: GraphQl Query.links carries relation links (for nested traversal)
-            // and the identifier-self link. Keep only the identifier-self / self-references so
-            // handleLinks applies WHERE id=X without consuming identifiers via relation joins.
+            // and the identifier-self link. Keep only the identifier-self link so handleLinks
+            // applies WHERE id=X. A relation link always carries a fromProperty/toProperty (even a
+            // self-reference whose toClass equals the resource class, e.g. a ManyToOne to self), so
+            // excluding those prevents consuming the identifier via a bogus relation join.
             if ($operation instanceof GraphQlOperation) {
-                return array_values(array_filter($links, static fn ($l) => null === $l->getToClass() || $l->getToClass() === $resourceClass));
+                return array_values(array_filter($links, static fn ($l) => !$l->getFromProperty() && !$l->getToProperty() && (null === $l->getToClass() || $l->getToClass() === $resourceClass)));
             }
 
             return $links;

tests/Fixtures/TestBundle/Entity/GraphQlMappedSelfReference/MappedSelfReference.php

@@ -0,0 +1,45 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Tests\Fixtures\TestBundle\Entity\GraphQlMappedSelfReference;
+
+use ApiPlatform\Metadata\ApiResource;
+use ApiPlatform\Metadata\GraphQl\Query;
+use ApiPlatform\Metadata\GraphQl\QueryCollection;
+use Doctrine\ORM\Mapping as ORM;
+
+#[ApiResource(
+    operations: [],
+    graphQlOperations: [
+        new Query(),
+        new QueryCollection(),
+    ]
+)]
+#[ORM\Entity]
+class MappedSelfReference
+{
+    #[ORM\Id]
+    #[ORM\Column(type: 'integer')]
+    #[ORM\GeneratedValue(strategy: 'AUTO')]
+    public ?int $id = null;
+
+    #[ORM\Column(type: 'string')]
+    public ?string $name = null;
+
+    // A real Doctrine association pointing back to the same resource class. Its
+    // link has toClass === resourceClass, so the GraphQL root-item filter must
+    // not mistake it for the identifier-self link and emit a bogus self-join.
+    #[ORM\ManyToOne(targetEntity: self::class)]
+    #[ORM\JoinColumn(name: 'parent_id', referencedColumnName: 'id', nullable: true)]
+    public ?self $parent = null;
+}

tests/Functional/GraphQl/MappedSelfReferenceTest.php

@@ -0,0 +1,84 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Tests\Functional\GraphQl;
+
+use ApiPlatform\Symfony\Bundle\Test\ApiTestCase;
+use ApiPlatform\Tests\Fixtures\TestBundle\Entity\GraphQlMappedSelfReference\MappedSelfReference;
+use ApiPlatform\Tests\RecreateSchemaTrait;
+use ApiPlatform\Tests\SetupClassResourcesTrait;
+
+/**
+ * A GraphQL item query on a self-referencing entity (a mapped ManyToOne pointing
+ * back to the same resource class) must apply WHERE id=X only. The relation link
+ * has toClass === resourceClass like the identifier-self link, but it must not
+ * survive the root-item filter, otherwise handleLinks emits a bogus self-join
+ * plus an extra WHERE condition and the item always resolves to null.
+ *
+ * @see https://github.com/api-platform/core/issues/8305
+ */
+final class MappedSelfReferenceTest extends ApiTestCase
+{
+    use RecreateSchemaTrait;
+    use SetupClassResourcesTrait;
+
+    protected static ?bool $alwaysBootKernel = false;
+
+    /**
+     * @return class-string[]
+     */
+    public static function getResources(): array
+    {
+        return [MappedSelfReference::class];
+    }
+
+    public function testItemQueryOnMappedSelfReferenceReturnsTheRecord(): void
+    {
+        if ($this->isMongoDB()) {
+            $this->markTestSkipped('MappedSelfReference is ORM-only.');
+        }
+
+        $this->recreateSchema([MappedSelfReference::class]);
+
+        $manager = $this->getManager();
+        $root = new MappedSelfReference();
+        $root->name = 'Root';
+        $manager->persist($root);
+        $child = new MappedSelfReference();
+        $child->name = 'Child';
+        $child->parent = $root;
+        $manager->persist($child);
+        $manager->flush();
+
+        // The child's parent is the root, not itself: the bogus self-join
+        // (WHERE parent.id = child.id) would never match, so this proves the
+        // self-reference link is excluded from the root item lookup.
+        $iri = '/mapped_self_references/'.$child->id;
+
+        $response = self::createClient()->request('POST', '/graphql', ['json' => [
+            'query' => <<<GRAPHQL
+            {
+              mappedSelfReference(id: "{$iri}") {
+                id
+                name
+              }
+            }
+            GRAPHQL,
+        ]]);
+
+        $this->assertResponseIsSuccessful();
+        $json = $response->toArray(false);
+        $this->assertArrayNotHasKey('errors', $json, json_encode($json['errors'] ?? null));
+        $this->assertSame('Child', $json['data']['mappedSelfReference']['name']);
+    }
+}